GitHub user yasserzamani opened a pull request:
https://github.com/apache/struts/pull/133
WW-4105 Considers config time class in actions chain
I think it is `ready for merge` and does not break backward compatibility.
The added `bean` attribute is and should be optional always.
If you agree and merged this, then
[784bb23](https://github.com/yasserzamani/struts/commit/784bb235e2ffcfcd7a5f2f47965ca0183e952ddd)
will be a base for other possible enhancements like:
- Considering config time class of the action in parameters interceptor
enhances S2 security (details already have been submitted to
`[email protected]`).
- Considering config time class of the action in json result has similar
impacts (prevents action information to be leaked to attacker).
What do you think?
# Documentation
Mainly, this is about how to deal when run time class of the action is not
same as the config time, e.g. when action is proxified with a 3rd party
technology or when the creation of action is with object factory. At this
point, operating S2 inside that technology or object factory makes problems or
potential security issues. So S2 always needs to know config time class of the
action to operate in it's own borders only.
Currently S2 uses `class` attribute for both config time class or bean name
of the action inside object factory. When the user uses `class` attribute as a
bean name, S2 looses this information, config time class of the action. This PR
gives it back to S2 by
[784bb23](https://github.com/yasserzamani/struts/commit/784bb235e2ffcfcd7a5f2f47965ca0183e952ddd)
and presents a resolution for
[WW-4105](https://issues.apache.org/jira/browse/WW-4105) as an example which
shows how to consider config time class of the action in sensitive places.
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/yasserzamani/struts WW-4751
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/struts/pull/133.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #133
----
commit 784bb235e2ffcfcd7a5f2f47965ca0183e952ddd
Author: Yasser Zamani <[email protected]>
Date: 2017-04-20T06:29:51Z
WW-4751 Adds optional `bean` attribute to action's config
commit e95224f26aa17dad6ad490473b4aeab1d2ceaf79
Author: Yasser Zamani <[email protected]>
Date: 2017-04-20T18:48:53Z
WW-4105 Considers config time class in actions chain
----
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at [email protected] or file a JIRA ticket
with INFRA.
---
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
